csrss[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

csrss.exe
Size

17KB
MD5

72565e7a0145e0657e586f6cf7696dc7
SHA1

11eba7b1e26cc7d492a2c161ac48370811d0b01e
SHA256

6f1c9b4c187669bc0371260d121caf48d65f829a9104c483befbd8fc0bed24f5
SHA512

e099ac9c0e6ed1ff8c3307f17ccb13a0306178679a3f7f5ab4b23699fad859b3101243e2782771ca2b9b8fa2785437fbe71a7f04633f45732eb3e0c998603d20
SSDEEP

384:yXrUnRpvW5cnWeA0lqMDBRJsYoiFWSlGsxoA:gUfpK0ld1PsHPe

Score

1^/10

Malware Config

Signatures

Files

csrss.exe
.exe windows x64

a96fa9912e09e361274ad77f1a4b252c

Code Sign

33:00:00:02:50:28:0f:7e:9e:d0:dd:ef:e5:00:00:00:00:02:50
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

31/01/2020, 19:26

Not After

22/01/2021, 19:26

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:83:64:9a:6a:0d:a4:65:d3:5c:29:4c:1b:c2:3b:7b:48:84:94:23:3d:f5:e3:6c:b7:9b:4b:45:37:99:9f:a9
Signer

Actual PE Digest

9b:83:64:9a:6a:0d:a4:65:d3:5c:29:4c:1b:c2:3b:7b:48:84:94:23:3d:f5:e3:6c:b7:9b:4b:45:37:99:9f:a9

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

11/05/2023, 10:10
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtSetInformationProcess
RtlSetHeapInformation
NtTerminateProcess
RtlSetUnhandledExceptionFilter
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
RtlUnicodeStringToAnsiString
NtTerminateThread
RtlCaptureContext
RtlFreeAnsiString
RtlAllocateHeap
RtlNormalizeProcessParams
isspace

csrsrv

CsrUnhandledExceptionFilter
CsrServerInitialization

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a96fa9912e09e361274ad77f1a4b252c

Code Sign

33:00:00:02:50:28:0f:7e:9e:d0:dd:ef:e5:00:00:00:00:02:50Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

9b:83:64:9a:6a:0d:a4:65:d3:5c:29:4c:1b:c2:3b:7b:48:84:94:23:3d:f5:e3:6c:b7:9b:4b:45:37:99:9f:a9Signer

Signature Validations

Verification

11/05/2023, 10:10 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

csrsrv

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 120B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 28B

33:00:00:02:50:28:0f:7e:9e:d0:dd:ef:e5:00:00:00:00:02:50
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

9b:83:64:9a:6a:0d:a4:65:d3:5c:29:4c:1b:c2:3b:7b:48:84:94:23:3d:f5:e3:6c:b7:9b:4b:45:37:99:9f:a9
Signer

11/05/2023, 10:10
Valid: false

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 120B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 28B